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Information with respect to a requested user who ac- 
cessed a node and information with respect to a process 
activated in the node are stored in a file system. By 
successively tracking nodes accessed by the user, a path 
through which the user accessed the network is 
tracked. When the path of the network entered different 
management domains, a tracking operation is requested 
to nodes in the management domains. The results are 
collected and transferred to the requesting node, 
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Storage means and for requesting the accessed node to 

DISTRIBUTED COMPUTER NETWORK FOR track a path through which the requested user accessed 

TRACKING THE ACCESS PATH OF A USER the network, information search means for searching 

process information in accordance with information 

BACKGROUND OF THE INVENTION 5 being transferred from the tracking request means from 

1 . Field of the Invention process information storage means, and information 
The present invention relates to a distributed type transfer means for transferring user information in ac- 

computer network for connecting and unifying a plural- cordance with process information searched by the 

ity of computer systems distributedly disposed through information search means to the tracking requesting 

a communication medium. node, whereby the tracking requesting node succes- 

2. Description of the Related Art sively requests the accessed node to track the requested 
Recently, a distributed type computer network for user through the tracking request means imtil the deter- 

allowing resources such as a file system and CPU to be mination means determined that the access of the local 

shared with a plurality of computer systems (hereinafter node or the accessed node by the requested user is a 

named nodes) has gained public attention. local access. 

The distributed type computer network can advanta- Thus, according to the present invention, without 

geously share its resources with the nodes distributed in considering the entire structure of the network, a path 

wide areas. However, as the network scale increases. through which a requested user accessed the network 

the probability of illegal accesses also proportionally can be readily and precisely tracked, 
increases. ^ 

To prevent that, it is necessary to track a node and a BRIEF DESCRIPTION OF DRAWINGS 

path through which an iUegal user accessed the net-. piG. 1 is a block diagram showing the entire struc- 

work so as to mjprove the reliability thereof. turc of a distributed type computer network of an em- 

Howcvcr, in most distributed type computer net- bodimcnt according to the present invention; 

works, at most the node just preying the path through 25 ^ ^ ^ ^^^^ ^ showing the structure of 

t^'l^ ^ ^ network can be „od„ i„ j^e distributed type computer network shown 

tracked. Thus, to completely track the path through |^ j^q |. 

which the illegal user accessed the network, many com- ' 3 \^ ^ ^^^^ describing an operation of 

phcated processes are required among all the related ^^^^^ ^ ^ ^^j^j, ^ 

nodes and Ojereby much labor and time are disadvanta- 30 distributed type computer network shown in 

FIG. 1; and 

SUMMARY OF THE INVENTION FIG. 4 is a flow chart showing an entire operation of 

An object of the present invention is to provide a tracking a path through which a requested user ac 

distributed type computer network for readUy and ac- 35 network. 

curately tracking a requested user from any node with- DESCRIPTION OF PREFERRED 

out considering the entire structure of the network. EMBODIMENTS 

Another -object of the present invention is to provide , r t. • j • 
a distributed type computer network for tracking a path reference to the accompanymg drawings, em- 
through which a requested user accessed the network 40 bodunents accordmg to the present mvenuon will be 
even if the path entered a plurality of management do- described in the following. 

Qiai,^^ FIG. 1 is a block diagram showing the entire struc- 

To accomplish the above mentioned objects, the dis- of a distributed type computer network of an em- 

tributed type computer network for tracking a path bodiment according to the present mvention. 

through which a requested user accessed a network, the 45 As shown in the figure, the distributed type computer 

distributed type computer network having a plurality of network is composed of a plurality of LAN's (local area 

nodes according to the present invention comprises user networks) 10, 20. and 30. The LAN*s 10, 20. and 30 arc 

information storage means for storing at least a user composed of communication mediums 11, 21, and 31 

name, distinctive information of a local access or a re- a plurality of nodes 12 to 16, 22 to 26, and 32 to 36, 

mote access, and an accessed node name for a remote 50 respectively, the communication mediums 11, 21. and 

access as information with respect to a user accessing 31 being connected to the plurality of nodes 12 to 16. 22 

the node, process information storage means for storing to 26, and 32 to 36, respectively. Particular nodes (12 

at least an activated process name and a process acti- Atxl 22; and 13 and 32) in the LAN*8 10, 20, and 30 are 

vated time as information with respect to a process connected through dedicated oommtmication mediums 

activated in the node, determination means for deter* 55 40 and 50. respectively. Thus, data communications are 

mining whether an access of the node by any requested made among all the nodes in the LAN's 10, 20. and 30. 

user is a local access or a remote access in accordance In the distributed type computer network, portions of 

with the distinctive information contained in the user the LAN's 10, 20, and 30 which are surrounded with the 

information, check means for checking an accessed dashed lines are named management domains. In other 

node name in accordance with the user name of the 60 words, data conununications are made directly among 

requested user by using the user information when the nodes only in each of the management domains, 

determination means determined that the node is re- FIG. 2 is a block diagram showing the structure of a 

motely accessed, tracking request means for transfer- node. In the figure, the reference numeral 60 is a com- 

ring to the accessed node checked by the check means puter system. The computer system 60 is connected to a 

at least a local node name, connection process activated 65 file system 61 and a display input terminal 62. The com- 

time and an activated process name in accordance with puter system 60 is provided with a tracking request 

the user name of the requested user stored in the user process 63 for requesting another node to track a path 

information storage means and the process information through which a requested user accessed the network; a 
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tracking service process 64 for receiving a tracking current time (b) transferred from the requesting node 

request from another node and for executing the track- 16, and obtains the error therebetween (in the step 407). 

ing; and a timer 65 for retrieving current time. Thereafter, the TSP 64B searches the process infor- 

In addition, the file system 61 stores all node names 66 mation which meets both the connection process ac- 

included in the management domain of the local node, 5 cording to the "name of the process activated, (d)** and 

user information 67, and process information 68. the "process" which designates the requesting node 16 

The user information 67 consists of the following from the file system 61 in the local node 12. 

Moreover, the TSP 64B detects the process infonna* 

(1) the name of the user who accessed a particular tion 68 where the value whose process activated time 
node; 10 ^as corrected by the time error between the nodes 

(2) the name of the accessing tenninal; accords with the process activation sUrt time (c) trans- 

(3) whether there was a remote access or a local ferred from the requesting node 16 (in the step 408). 
access; and When the TSP 64B searched the process information 

(4) the name of the accessing node (in the case of a 68, it searches the requested user information 67 from 
remote access). 15 activated tenninal name included in the process 

The process inforniation 68 consists of the following information 68 and determines that the user name of the 

user information 67 is the requested user (in the step 

(1) the name of the process activated; 409). 

(2) the activated time; and When the TSP 648 did not obtain the process infor- 

(3) the name of the terminal activated. ^" mation which meets the time in the step 408, it serially 
Then, with reference to FIGS. 3 and 4, an operation numbers the groups of the process information 68 in 

of the distributed type computer network will be de- chronological order and searches the process informa- 

tion 68 whose number matches the serial number (e) 

In the node 16 of the LAN 10 (management domain) transferred from the requesting node 16. 

shown in FIG. 3. when a requesting user designates a Thereafter, the TSP 64B searches the user informa- 

user name to be tracked, a tracking request process tion 67 in accordance with the process information 68 

(hereinafter named the TRP and illustrated in the flow from the file system 61 in the local node by using the 

chart of FIG. 4) 63A in the node 16 is activated. activated terminal name and then transfers the user 

Thereafter, the TRP 63A retrieves the user informa- ^ information 67 to the TRP 63A in the requesting node 

tion 67 in the file system 61 by using the user name as 16 (in the step 410). 

key dau (in the step 401). The TRP 63A determines Practically, the following information is transferred 

whether or not the requested user is a local user or a to the TRP 63A in the requesting node 16: 

remote user by using the resultant data (in the step 402). (I) the name of the user; 

When the TRP 63A determined that the requested 35 (2the connection process activated time (value where 

user is a local user, it informs the requesting user of that error has been corrected); 

through the display input terminal 62 and terminates the (3) the name of the accessing terminal; 

tracking operation (in the step 403). (4) whether there was a remote access or a local 

On the other hand, when the TRP 63A determined access; and 

that the requested user is a remote user, it checks the 40 (5) the name of the accessing node and the name of 

node from which the requested user accessed the net- the used connection process (in the case of remote 

work in accordance with the user information 67 being access). 

checked (in the step 404). Thereafter, the TRP 63A in the requesting node 16 

Thereafter, the TRP 63A determines whether or not displays such information on the display input terminal 

the accessing node 12 is in the local management do- 45 62. In addition, the TRP 63A redetermines whether the 

main in accordance with the node names 66 in the local requested user is a local user or a remote user in the 

domain stored in the file system 61 (in the step 405). node 12 in accordance with the above mentioned user 

When the TRP 63A determined that the accessing information in the step 402. Thereafter, when the TRP 

node 12 is in the local management domain, it transfers 63A determined that the requested user is a local user, it 

the following information items to a tracking service 50 terminates the tracking operation (in the step 403). 

process 64B (hereinafter named the TSP and illustrated When the TRP 63A determined that the requested 

in the flow chart of FIG. 4) in the accessing node 12 and user is a remote user, it redetermines whether or not the 

requests it to track a path through which the requested accessing node represented with the information (5) is 

user accessed the network (in the step 406): included in the local management domain in the step 

(a) the name of the local node; 33 405. 

(b) the current time; As the result, when the TRP 63A determined that the 

(c) the time the process activated; accessing node is included in the local management 

(d) the name of the process activated (the name of the domain, it requests the TSP in the accessing node (not 
activated connection process used for a remote shown in the figure) to track the path through which 
Access); and 60 the requested user accessed the network (in the step 

(e) a serial niunber (which represents a serial access 406). 

number when the same connection process is used Thereafter, this operation is repeated until the TRP 

in a local nodes). 63A determines that the requested user is a local user. 

Thus, the node 16 waits for the accessing node 12 to When the TRP 63A determined that the accessing 

transfer the resultant data to it. 65 node is in another management domain in the step 405, 

When the TSP 64B in the node 12 received the track- it requests the TSP 64C in the accessing node 22 to 

ing request, it retrieves the current time of the local track the path through which the requested user ac- 

node 12 by using the timer 65B, compares it with the cessed the network (in the step 411). 
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When the TSP 64C received the tracking request, it * 
subsUtutionalJy starts Uacking the path through which 
the requested user accessed the network in the manage- 
ment domain included in the local node 22 instead of the 
node 16 which requested the tracking operation (in the 5 
step 412). 

Likewise, the processes from the step 401 to the step 
412 arc repeated. 

When the TRP «A determined that the requested 
user IS a local user in the step 402. the TSP 64C in the 
node 22 transfers all the collected information with 
respect to the network tracking path to the TRP 64A in 
the requesting node 16 (in the step 413) and then termi- 
nates the tracking operation (in the step 403). 

As was described above, in the distributed type com- 
puter network according to the present invention, a 
path through which a requested user accessed the net- 
work can be determined rapidly and accurately without 
considering the overall structure thereof. 

Moreover, in the distributed type computer network ^ 
according to the present invention, even if the network 
access path entered a plurality of management domains, 
a path through which a requested user accessed the 
network can be rapidly and accurately determined, 

What is claimed is: 

1. A distributed computer network for tracking a 
path through which a user accessed a network, said 
distributed computer network having a plurality of 
domains, each of said domains having at least one node. 30 
each of said nodes comprising: 

a node bus; 

first determination means for determining if the node 
was accessed by a user locally or remotely, con- 
nected to the bus; 35 
user information storage means, connected to the bus, 
for storing a name of a user accessing the node, 
whether the node was accessed by a local access or 
a remote access as determined by the first determi- 
nation means, and an accessing node name when 40 
the first determination means determines that the 
node was accessed remotely; 
process information storage means, connected to the 
bus. for storing an activated process name and a 
process activated time as information with respect 
to a process activated in said node; 
second determination means, connected to the bus, 
for determining whether an access of said node by 
said user is a local access or a remote access by 
examining the stored information of the user infor- ^ 
mation storage means; 
check means, connected to the bus, for checking a 
name of an accessing node in accordance with the 
user name of said user by using said user infoima- 5, 
tion stored in said user information storage means 
when said second determination means determines 
that said node is remotely accessed; 
tracking request means, connected to the bus, for 
transferring to said accessing node checked by said ^ 
check means.' tracking information including a 
local node name of the accessing node, a connec- 
tion process activated time and an activated pro- 
cess name in accordance with the user name of said 
user stored in said user information storage means 65 
and said process information storage means and for 
requesting said accessing node to track a path 
through which said user accessed the network; 



mformation search means, connected to the bus. for 
searching process information for tracking infor- 
mation from another node requesting tracking; and 
information transfer means, connected to the bus, for 
transferring user information in accordance with 
the process information searched by said informa- 
tion search means to said another node requesting 
tracking; 

whereby said another node requesting tracking suc- 
cessively requests said accessing node to track said 
user through said tracking request means until said 
determination means determined that the access of 
the local node or said accessing node by said re- 
quested user is a local access. 
2. A distributed computer network in which a plural- 
ity of nodes are included in a plurality of management 
domains, each of said nodes comprising: 
a node bus; 

first determination means, connected to the bus, for 
determining if the node was accessed by a user 
locally or remotely; 

user information storage means, coimected to the bus, 
for storing a user name, whether the node was 
accessed by a local access or a remote access as 
determined by the access determining means, and 
an accessing node name when the first determina- 
tion means determines that the node was accessed 
remotely; 

process information storage means, connected to the 
bus, for storing an activated process name and a 
process activated time as information with respect 
to a process activated in said node; 

node name storage means, connected to the bus, for 
storing node names in a management domain of 
said node; 

second determination means, connected to the bus, 
for determining whether an access of said node by 
a user is a local access or a remote access using said 
stored information indicating whether the node 
was accessed by a local access or a remote access 
stored in said user information storage means; 
check means, connected to the bus, for checking a 
name of an accessing node in accordance with the 
user name of said user by using said user informa- 
tion stored in said information storage means when 
said second determination means determines that 
said node is remotely accessed; 
third determination means, connected to the bus, for 
determining whether or not a name of said access- 
ing node determined by said second determination 
means is stored in said node name storage means- 
tracking request means, connected to the bus. for 
transferring to said accessing node a local node 
name of the accessing node, a connection process 
activated time and an activated process name in 
accordance with a user name of said requested user 
stored in said user information storage means and 
said proc^ information storage means and for 
requesting said accessed node to track a path 
through which said user accessed the network 
when said third determination means determines 
that said accessing node name is stored in said node 
name storage means; 
information search means, connected to the bus, for 
searching process information for tracking iilfor- 
mation from another node requesting tracking; 
first information transfer means, connected to the bus 
for transferring user information in accordance 
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with the process information searched by said in- 
formation search means to said anther node re* 
questing tracking; 

tracking substitute request means, connected to the 
bus, for requesting said accessed node to substitu- 
tionally track a path through which said user ac- 
cessed the network when said third determination 
means determines that said accessed node name is 
not stored in said node name storage means; and 

second information transfer means, connected to the 
bus, for transferring a network access path tracked 
by said requested node to said another node re- 
questing tracking. 

3. A distributed computer network as set forth in 
claim 1 or claim 2, each of said nodes further compris- 
ing: 

timer means, connected to the bus, for retrieving a 
current time; 



10 



15 



request means requests said accessed node to track 
the path through which said user accessed the 
network; 

time error computation means, connected to the bus, 
for computing an error between the current time 
transferred from another node through said time 
transfer means and thai of said timer means of the 
local node; and 
time correction means, connected to the bus, for 
correcting a correction process activated time 
transferred from said another node through said 
tracking request means in accordance with said 
error computed by said error computation means. 
4. A distributed type computer network as set forth in 
claim 1 or claim 2. whereby said user information stor- 
age means and said process information storage means 
further store a node access terminal name and a process 
activated terminal name so as to relate the user informa- 



time transfer means, connected to the bus, for trans 

ferring said current time retrieved by said timer 20 tion with the process mformation. 
means to said accessing node when said tracking • • ♦ 
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